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WHAT IS A BIOMETRIC SYSTEM? 


Physical Traits: 
e [ris 
Fingerprint 
Ear Shape 
DNA 

Face 

Vein Pattern 


Behavioural Traits: 
e Gait 
e Voice 
e Signature 
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HOW BIOMETRIC SYSTEMS WORK? 


| | Identity 


TEMPLATES 


extract stored 
features for that 
identity 
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Presentation attacks are performed at the 
sensor level: the sensor is fooled and not 
replaced nor tampered 


Presentation 
Attack 


BIOMETRIC SYSTEMS ATTACKS 


Override 2 DATA 
Database STORAGE 


Modify Biometric 
Reference 


SIGNAL 


2 RUE | PROCESSI COMPARI 
NG SON 
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Віотеігіс fy Modify Score ipti 
Sample | | s ecision 
Override Capture Override Signal Override Override Decision 
Device Processor Comparator Engine 
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| PRESENTATION ATTACKS IN REAL LIFE 
Құ” ж” BANK ROBBERY AND MASKED PLANE PASSENGER 


UNITED STATES 2015 UNITED STATES 2010 


Suspects on the 
left and suspects 
wearing masks 
on the right 


CANADA 2014 CHINA 2011 
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PRESENTATION ATTACKS IN REAL LIFE 
FAKE FINGERS 


X? 4 
| 11 meses - Via Buenos Aires 
Echaron a seis empleados de Aerolíneas Argentinas que 
falseaban sus ingresos con dedos de silicona 
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HOW 3D PRINTING COULD HELP TO BYPASS 
BIOMETRIC SYSTEMS 
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MAKING MY OWN EXPERIMENTS TO BYPASS 
BIOMETRIC SYSTEMS 


YOU TOLD ME YOU HAD AL 


) 2 


OTOF MONEY INVESTED 


é 
S set 
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FINGERPRINT RECOGNITION 


Short ridge 


Minutiae and Typica 
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FINGERPRINT SENSORS 
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OPTICAL FINGERPRINT SENSOR 


Air ----- 

— Skin contact point ++- —— ----- A valley Optical fingerprint sensors 
z : : î are the oldest method of 
capturing and comparing 


fingerprints. this technique 


relies on capturing an 
optical image, essentially a 
photograph, and using 

= algorithms to detect unigue 


patterns on the surface, 
such as ridges or unigue 
marks, by analyzing the 
lightest and darkest areas of 
the image. 


— To image 
¿A —1 sampling 
“е and processing 
Light source Image sensor circuitries 
(such as an LED) (such as CCD or CMOS) 
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CAPACITIVE FINGERPRINT SENSOR 


Capacitive fingerprint sensors 
finger ridge finger valley use tiny capacitor circuits to 


collect data about a fingerprint. 
conductor plates / | As capacitors can store electrical 
inverting 


charge, connecting them up to 

conductive plates on the surface 

of the scanner allows them to be 

used to track the details of a 
amplifier : : 

fingerprint. 


insulating layer 


supply voltage 
terminals 


output terminal 


inverting 


inal 
termina The charge stored in the 


capacitor will be changed slightly 


input when a finger's ridge is placed 
PL —Á over the conductive plates, while 
an air gap will leave the charge 
| | at the capacitor relatively 
non- unchanged. An integrator circuit 
f  inverting is used to track 
: Boi terminal these changes. 
voltage 
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ULTRASONIC FINGERPRINT SENSOR 


— Fingertip Valley 


The hardware consists of an 
ultrasonic transmitter and a 
receiver. An ultrasonic pulse 
is transmitted against the 
finger that is placed over the 
scanner. Some of this pulse 
is absorbed and some of it 
is bounced back to the 
sensor, depending upon the 
ridges, pores and other 
details that are unique to 
each fingerprint. 
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DEVICES TO TEST: CELLPHONES AND 
ATTENDANCE SYSTEMS 


Hysoon FF395 
Optical Fingerprint 
Scanner 

Face Recognition 


Samsung Galaxy S10 
Ultrasonic Fingerprint 
Scanner 

Face Recognition 


SANSUNG 


GALAXY S10 


TA040 . Samsung Galaxy A30 
Optical Fingerprint B = Capacitive Fingerprint 
Scanner 2 = Scanner 


Face Recognition 
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MATERIALS NEEDED FOR THE TESTS (THESE AND 
A LOT MORE) 


2 
¿yo PARA TOM, E 
С A DE IMPRESIONES DENTAL 


za 


plasticola 
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GREASE ATTACKS 


Preconditions for the attack 


For using this kind of attack one needs to have a clear 
grease stain left on the surface of the scanner. This stain 
has to have most of the important characteristics of the 
fingerprint left on the pad so that the scanner can reliably 
read the same line-ends and curves that it detected on the 
previous user 


Requirements: 


Fingerprint scanner 
Legitimate user enrolled fingerprint 

. Applicable fingerprint stain on the scanner's pad left by 
the previous user 

. Temperature between 0-50*C (scanners operating 
temperature) 
Gummy bears, silicone fingertips, playdoh, latex gloves 
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Materials Tested and Results: 

e Gummy Bears: Finger recognized 

e Playdoh: Finger recognized 

* Latex Glove: Finger recognized 

* Moist Breathe: No Finger recognized 
e Silicon Fingertip: Finger recognized 


EE e tc 
„u. e 0 © «v 


Materiales used Optical1 
Gummy Bears NO 

Tinfoil NO 

Playdoh NO 
Latex Glove МО 
Breathe МО 
Silicon Fingertip МО 


as 


GREASE ATTACK RESULTS 


Sensor Fooled 


Capacitive 
МО 
МО 
МО 
МО 
МО 


Ultrasonic 
NO 
МО 
МО 
МО 
МО 
МО 


Optical2 
МО 
МО 
МО 
МО 
МО 
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“ENHANCED” GREASE ATTACKS AND RESULTS 


The problem with grease attacks is that in most cases, a regular grease stain on the scanner surface is not 
enough to fool the sensor. We need to enhance it with other substances to obtain better results 
impersonating legitimate users, these substances must be transparent so that the user does not notice 
them and with ointment consistency to better enhance the fingerprint stain. This substance could be spread 
in the legitimate user fingerprint or on the fingerprint sensor. 


Materials Sensor Fooled 
Materiales used Opticall Capacitive Ultrasonic Optical2 
Researchers Glicerin + Latex Glove NO NO NO NO 
Fingerprints are Hand Moisturizer + Latex Glove Ne) Ne) NO NO 
Blurred Petrolatum Ointment + Latex Glove YES YES NO YES 
Petrolatum + Paraffin + Latex Glove YES VES МО YES D REAM LAB 


Cocoa Butter Lip Balm + Latex Glove YES YES NO YES TECHNOLOGIES 
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The term consensual suggests the user we are taking the 
fingerprint from is aware of the process and actively participates b 
pressing his finger into some kind of a mold. 

Even though we have classified this approach as “consensual”, 
there are unconsensual ways to go about achieving the same. 


Materials for Molds: 


e Alginate 

* Epoxy putty 
e Playdoh 

e Hot Glue 

e Candle Wax 


Researchers 
Fingerprints are 
Blurred again 


Preconditions for the attack 


Materials for Casting: 


e Silicone 
e Ballistic gelatin 


e Liquid latex 
e Synthetic Resin 


e Wood glue 


Um 
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CONSENSUAL ATTACKS RESULTS 


Casting Optical Capacitive X Ultrasonic Optical2 
Silicone YES NO NO YES 
Silicone NO NO NO NO 
Silicone YES NO NO YES 
Silicone YES NO NO YES 
Silicone YES NO YES YES 
Ballistic gelatin NO NO NO МО 
Ballistic gelatin NO NO МО МО 
Ballistic gelatin NO NO NO NO 
Ballistic gelatin NO NO NO NO 
Ballistic gelatin NO NO NO NO 
Liquid latex YES YES YES YES 
Liquid latex NO NO NO NO 
Liquid latex YES NES NO YES 
Liquid latex YES VES YES YES 
Liquid latex YES NO YES YES 
Sintetic Resin NO NO NO NO 
Sintetic Resin NO NO NO NO 


ot Glue Wood glue 
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UNCONSENSUAL ATTACKS (WITHOUT 
COOPERATION) 


In these attacks the user does not participate actively and latent 
fingerprints are obtained in a non-cooperative way. Assuming the 
correct latent fingerprint has been identified, the following are the 
steps to follow: 


Materials 
Procedure 
e Ethylcyanoacrylate Glue 
1. Enhancing the latent fingerprint * Fingerprint Powder and brush 
with glue fumes or fingerprint powder + Digital Camera with macro functionality 
2. Lifting the latent fingerprint with * Transparent Tape 


digital camera or transparent tape e Fingerprint Ink Pad 
3. Digitally enhancing the fingerprint * Transparency 


with software * Plastic wrap 
4. Creating a mold * Latex glove 
5. Casting artificial fingers with * Silicone 
silicone, liquid latex or wood glue * Liquid Latex 
* Wood glue 
e Paper 
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UNCONSENSUAL ATTACKS RESULTS 


Materials 
Material1 Material2 Optical Capacitive Ultrasonic Optical2 
Fingerprint Ink Paper NO NO NO NO 
Fingerprint Ink Plastic wrap NO NO NO NO 
Fingerprint Ink Latex glove NO YES YES NO 
Transparent Tape Fingerprint enhanced with fingerprint powder NO МО МО МО 
Transparent Tape Fingerprint enhanced with cyanoacrylate NO NO NO NO 
Offset Plate Silicone NO NO NO NO 
Offset Plate Liquid Latex NO NO МО МО 
Offset Plate Wood glue NO NO NO NO 
Transparency Silicone NO NO NO NO 
Transparency Liquid Latex YES NO NO YES 


Transparency Wood glue 
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UNCONSENSUAL ATTACKS WITH 3D PRINTING: 
MATERIALS AND SOFTWARE 


yl@ws17:-/tools/Fingerprint-Enhancement-Python/src$ 15 


enhanced2bw.jpg image enhance.py ridge freg 2.py ridge segment.py 
enhanced2. jpg image_enhance.pyc ridge_freq.py ridge_segment.pyc 
enhanced. jpg main_enhancement.py ridge Ғгеа.рус 

freguest.py ridge filter.py ridge_orient.py 

frequest.pyc ridge_filter.pyc ridge orient.pyc 


yl@ws17:-/tools/Fingerprint-Enhancement-Python/src$ 


The precision of a domestic UV Resin printer is 25 microns. Human papillary ridges in 
general have a height between 20-60 microns. 
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UNCONSENSUAL ATTACKS WITH 5D PRINTING 


Procedure 


1. Lift the latent fingerprint with a digital camera with macro functionality 


2. Use a tool for digitally enhance the fingerprints, for example this Python tool based on the 
Utkarsh-Deshmukh tool: https://github.com/ylevalle/Fingerprint-Enhancement-Python 


Digitally 

enhanced З. Convert the enhanced JPG file to an SVG file, import the SVG file into Tinkercad to create 
test a 3D model of the fingerprint 

fingerprint 


% 4. Configure the fingerprint length and width according to the measures of the original latent 
SS? fingerprint, put a thin back block behind the fingerprint, configure the ridge height and create 
two different 3D models: one negative or hollow for casting and one positive for direct tests. 


5. Export the 3D models file in a 3D printable file format (STL) and upload it on the Anycubic 
= Photon 3D Printer. 


6. Once the printing is completed, the 3D printed molds require rinsing in Isopropyl alcohol. 
After rinsed parts dry, the molds require post-curing using an UV lamp or direct sunlight. 


7. Fill the 3D printed negative or hollow molds with: 
e liquid latex or wood glue 
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UNCONSENSUAL ATTACKS WITH 3D PRINTING: 
RESULTS 


af : 


Materials Results 
Materiall Material2 Optical Capacitive Ultrasonic Optical2 
Fingerprint on glass UV DLP Resin positive from photo ves NO YES NO 
Inked fingerprint UV DLP Resin positive from photo YES NO YES NO 
Fingerprint on glass 3D mould from photo YES YES YES YES 
Inked fingerprint 3D mould from photo YES YES YES YES 
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NEXT STAGE OF THE RESEARCH: FACIAL 
RECOGNITION SYSTEMS 
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VIRUS ALERT 


Safe Mode 
EZ OG i 1 
Safe Mode with Command Prompt 
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